Does the API support the French app version? (Login returns 400 error)

[aminsaffar-bit]

Hi,

I’m currently trying to use the picnic-api project and I have a question regarding regional support.
Does this API support the French version of the Picnic app?

I attempted to log in while setting the country code to "FR", but the request consistently returns a 400 error during authentication.
Is the French app version supported, or is the API limited to specific regions (e.g., NL/DE)?

Thanks in advance for your help!

[MRVDH]

Hi @aminsaffar-bit, I have never tested the api with the french config, but I would imagine that it uses the same APIs so it should work. As I don't live in France nor have a French account, I am unfortunately unable to test it. I'll leave this ticket open as maybe someone else can help you with it.

[coderhammer]

Hey @MRVDH how do you discover the API? Do you reverse engineer from a mobile app or something? As they don't seem to have any other interface in France from a customer point of view

[MRVDH]

Hi @coderhammer ! I used to intercept the network traffic but have been unable to do so lately.

More recently I simply download the latest apk file from apkpure, and then decompile it with jadx using the command jadx app.apk -d app-src --show-bad-code --deobf. Then I use AI agents to do research on the decompiled codebase (instructions are in AGENTS.md).

AI really is the key factor here. Before AI was big (5/6+ years ago) I went through it 'by hand' and it took a long time to find stuff, now I find things instantly.

[coderhammer]

I actually succeeded in generating an authKey with the region set to FR but ended with 2 factor authentification required on subsequent calls. Not sure if there is something I can do about that, I'll try to open the source code as you mentioned, thanks for the tip!

EDIT: I succeeded in using the methods you provide to comply with 2FA so I can confirm it works for the FR region

[MRVDH]

@coderhammer thank you for the investigation!

@aminsaffar-bit you could try the 2FA flow instead, let me know if that works.